Security updates, practical field notes, and deep dives from the project.
Apr 30, 2026 • 5 min
Two malicious versions of the PyTorch lightning training package activate silently on import, sweeping developer credentials, cloud provider secrets, cryptocurrency wallets, and CI pipeline tokens from the affected machine.
Read postApr 29, 2026 • 9 min
A preinstall hook in four SAP packages drops an 11.7 MB credential stealer onto developer machines and CI runners, targeting cloud secrets, GitHub tokens, and Actions secrets.
Read postMar 31, 2026 • 10 min
The lead axios maintainer's npm account was hijacked and two malicious versions deployed a cross-platform RAT via a pre-staged dropper package. With ~100M weekly downloads, this is among the most impactful supply-chain attacks on record.
Read post